CVE-2026-109601

Deferred Deferred - Pending Action

Arbitrary File Read in Frappe Framework via Email HTML Attributes

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109601

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

Frappe Framework versions before 15.117.0 and 16.x before 16.30.0 have an arbitrary file read vulnerability. Attackers can exploit this by setting an attribute value in outgoing email HTML to reference a local file path, allowing them to read sensitive server files.

Impact Analysis

This vulnerability allows attackers with access to outgoing email content to read sensitive files on the server. This could lead to unauthorized access to confidential data, system configuration files, or other critical information stored on the server.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from this vulnerability.

Mitigation Strategies

Upgrade Frappe Framework to version 15.117.0 or later if using 15.x, or to 16.30.0 or later if using 16.x. This addresses the arbitrary file read vulnerability in outgoing email HTML handling.

Hi! I’m here to help you understand CVE-2026-109601. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70